Among the model level defense strategies, the majority of them also fail under the FedGAN pipeline. For example, the diagnostic approach requires a certain pre-trained meta-classifier [1]}, [2]}, which is inappropriate for GAN's scenario, where the discriminator and the generator need to train against each other at the beginning. The unlearning approach takes two steps, first, the infected data need to be detected, and then the model will unlearn such data [3]}, [4]}. This strategy works well for classification tasks given its reversible objective function, but it again does not fit the scenario of GAN, where both the discriminator and the generator train against each other through the minmax loss function as specified in equation REF , which cannot be easily reversed as the classification loss forms. The trigger synthesis approach requires the defender to access data information [5]}, [6]}. Additionally, because the FedGAN diverged before the trigger was synthesized in our example, the synthesizing trigger practice does not suit the FedGAN discipline.
